Search

We describe a novel type of weak cryptographic private key that can exist in any discrete logarithm based public-key cryptosystem set in a group of prime order $p$ where $p-1$ has small divisors. Unlike the weak private keys based on \textit{numerical size} (such as smaller private keys, or private keys lying in an interval) that will \textit{always} exist in any DLP cryptosystems, our type of weak private keys occurs purely due to parameter choice of $p$, and hence, can be removed with appropriate value of $p$. Using the theory of implicit group representations, we present algorithms that can determine whether a key is weak, and if so, recover the private key from the corresponding public key. We analyze several elliptic curves proposed in the literature and in various standards, giving counts of the number of keys that can be broken with relatively small amounts of computation. Our results show that many of these curves, including some from standards, have a considerable number of such weak private keys. We also use our methods to show that none of the 14 outstanding Certicom Challenge problem instances are weak in our sense, up to a certain weakness bound.

We propose an algorithm for computing an isogeny between two elliptic curves $E_1,E_2$ defined over a finite field such that there is an imaginary quadratic order $\mathcal{O}$ satisfying $\mathcal{O}\simeq \operatorname{End}(E_i)$ for $i = 1,2$. This concerns ordinary curves and supersingular curves defined over $\mathbb{F}_p$ (the latter used in the recent CSIDH proposal). Our algorithm has heuristic asymptotic run time $e^{O\left(\sqrt{\log(|\Delta|)}\right)}$ and requires polynomial quantum memory and $e^{O\left(\sqrt{\log(|\Delta|)}\right)}$ classical memory, where $\Delta$ is the discriminant of $\mathcal{O}$. This asymptotic complexity outperforms all other available method for computing isogenies. We also show that a variant of our method has asymptotic run time $e^{\tilde{O}\left(\sqrt{\log(|\Delta|)}\right)}$ while requesting only polynomial memory (both quantum and classical).

This study has revealed that a vehicle can be produced to meet all essential requirements specified in the QMR for a new 1/4-ton truck, with the exception of reliability. Reliability as stated in the QMR is unrealistically high and beyond the present state of the art. There will be some reduction of land mobility due to the floating capability requirements. The cost of the floatable vehicle would be higher than the desired target cost by 46%. An austere vehicle can be produced for the desired target cost of $1900, but this vehicle would not be the most effective vehicle for its initial and operational cost. The vehicle determined the most suitable by this study does not differ greatly from the present M151.